Instructor: Malware analysis. 2 2
In this lesson, 3 3
I'm going to do a little bit of static and dynamic malware 4 4
analysis and then we're going to go through and look at how we 5 5
can look through a debugger and decompiler 6 6
to analyze some of the code. 7 7
Now, again, stick with me here. 8 8
You don't have to actually be able to do 9 9
all the things I'm going to show you here. 10 10
This is just to give you an introduction to some of the 11 11
tools and techniques that reverse engineers use. 12 12
Let's go ahead and get started. 13 13
Now, the first thing we're going to do before trying 14 14
dynamic analysis is go and look at it statically. 15 15
And so we're going to open up a command prompt. 16 16
So click on your Windows icon and type in the word command. 17 17
And from the command prompt, 18 18
we want to change directories into the desktop. 19 19
And if you notice here, 20 20
we do have Trickster on the desktop. 21 21
Now, we need to extract Trickster. 22 22
So we're going to right-click it, go to 7Zip, 23 23
and go to extract here. 24 24
It's going to ask us for the password 25 25
and the password is malware123. 26 26
We've password protected this to make sure you don't 27 27
accidentally unzip it on a system you don't want to. 28 28
So in this case, 29 29
we're going to go ahead and hit okay and you'll now see 30 30
Trickster is there on the desktop. 31 31
If we hit DIR again, you'll see there it is. 32 32
So what we want to do is pull out 33 33
any ASCII strings inside that 34 34
binary by going through a program called Floss, 35 35
and it's F-L-O-S-S. 36 36
And then the name of the file you want it to search through, 37 37
which will be trickster.exe. 38 38
And we're going to pipe that into a text file called 39 39
trickster_strings.txt. 40 40
That's going to go through that entire file, 41 41
find anything that looks like an ASCII character 42 42
text that we can read, 43 43
and put it into a file for us to review. 44 44
So to look at that, 45 45
we're just going to use type and then tricksterstrings.txt 46 46
and then the command more to see it a page at a time. 47 47
Now notice here it says there's a comment. 48 48
This program cannot be run in DOS. 49 49
That's fine. 50 50
And then it's going to start outputting 51 51
any ASCII characters it finds. 52 52
And then you can see here it found 2W3, 53 53
it found this garbage, it found .text, .rdata, .data, 54 54
and then a whole bunch of stuff 55 55
that just looks kind of encrypted. 56 56
And if I go a couple more pages here, 57 57
you're going to see there's a lot of content 58 58
that I just can't read. 59 59
It doesn't make any sense. 60 60
What is all this data here? 61 61
Well, what I'm really looking for is IP addresses. 62 62
I'm looking for host names. 63 63
I'm looking for email addresses or program file names 64 64
or anything like that. 65 65
But in the case of Trickster, 66 66
all I'm finding is a garbled mess. 67 67
That indicates that this malware 68 68
has been protected using encryption to keep people 69 69
like us trying to do malware analysis 70 70
from detecting its true source. 71 71
And that means that static analysis here isn't going to work 72 72
real well because it's all encrypted. 73 73
Okay, so Trickster was encrypted 74 74
and we couldn't do static analysis, 75 75
but here's where it gets fun. 76 76
We're going to look at this thing dynamically. 77 77
We're going to start running the program and try to identify 78 78
its purpose and what the file does. 79 79
We're going to try to figure out what 80 80
the malware does to the system. 81 81
What changes does it make? 82 82
Does it call out to a remote website? 83 83
Does it download files? 84 84
Does it mess up your registry? 85 85
What is it going to do? 86 86
Well, we're going to figure that out here. 87 87
So, the first thing we want to do here is we want to create 88 88
a known good baseline of our system. 89 89
What I want to figure out is, 90 90
what does the registry look like? 91 91
What does the task manager look like? 92 92
What does the schedule task look like? 93 93
All of those type of details. 94 94
And to do that, 95 95
we can use a program from system internals called Auto Runs, 96 96
A-U-T-O-R-U-N-S, Auto Runs. 97 97
Just go ahead and enter it from your command prompt and hit 98 98
enter and the program will launch for you. 99 99
I'm going to go ahead and maximize it here and I'm going to go 100 100
ahead and go to file and there's 101 101
a setting called run as administrator. 102 102
I want to do that so that system internals and Auto Runs can 103 103
see the entire system regardless of what user it is. 104 104
And so we're going to let it run here for a second. 105 105
It'll take about 30 seconds. 106 106
And when it's done, 107 107
it's going to say ready in the bottom left corner, 108 108
as it just did. 109 109
This is the baseline. 110 110
This is a system that is not infected with malware. 111 111
Nothing bad has happened yet. 112 112
So what we want to do is go to file and save this. 113 113
And I'm going to save this to the desktop 114 114
and I'm going to call it baseline. 115 115
Go ahead and save. 116 116
And you'll see that it does show up here 117 117
on my desktop right there, baseline.autorun file. 118 118
Now, what do we want to do next? 119 119
Well, we want to run Trickster 120 120
and we want to run it as an administrator. 121 121
So we're going to right-click it and say 122 122
run as administrator and infect this machine. 123 123
Go ahead and hit yes, give it a second here, 124 124
and Trickster will run and start 125 125
doing whatever it does to our machine, 126 126
which we don't know what it does yet. 127 127
But we can find that out. 128 128
So what we're going to do is maximize our Auto Runs again. 129 129
Go over here to the refresh button and hit refresh. 130 130
It's going to scan your system again and figure out what does 131 131
an infected system look like. 132 132
So, now that it's done and it's ready, 133 133
we're going to go up to file and compare it 134 134
to our known good baseline, that baseline.arn file. 135 135
And all this is going to do is take what the current system 136 136
found and then take away anything 137 137
that was in the old baseline system. 138 138
And whatever's left is what Trickster did. 139 139
So if we go ahead and hit open, we have one thing. 140 140
All Trickster did when it ran was added a task scheduler, 141 141
and it has one called services update, 142 142
and the file that it's telling it to run is this 143 143
users/ieuser/appdata/roaming/winappusjdltufs.exe. 144 144
Now, as I talk about this file, 145 145
when we go through our analysis, 146 146
I'm going to refer to it as u.exe because 147 147
I don't want to have to keep saying USJDLTUFS 148 148
because that's just a really, long weird name. 149 149
So anyway, we see here that this was a change 150 150
to the task scheduler. 151 151
It didn't touch the registry, 152 152
it didn't touch the file system with the exception of 153 153
putting this one file here in this path 154 154
and it's being run through the task scheduler. 155 155
So, to look further into it, 156 156
we're going to go into our task scheduler. 157 157
So let's go ahead and open up our task scheduler by clicking 158 158
on the Windows icon and typing in task scheduler. 159 159
And there it is. 160 160
Go ahead and open it. 161 161
We'll maximize this here. 162 162
And you can see that task name services update is showing up 163 163
here and it's set to run at 5:03 PM, 164 164
which is in about three minutes from now. 165 165
And it has multiple triggers defined. 166 166
So let's go ahead and look at these triggers 167 167
and figure out what does this file do. 168 168
So if I double-click on it, 169 169
it will open up and you'll see that 170 170
the nameless services update. 171 171
You'll see the description is look for services monitor, 172 172
which doesn't really make much sense in English, 173 173
so that tells me that this may also 174 174
be not a legitimate program. 175 175
Now, let's go ahead and look at triggers. 176 176
Under triggers, there are two triggers. 177 177
Anytime somebody logs on the system, 178 178
this task is going to be run and then 179 179
it's going to happen daily at 5:00 PM every day, 180 180
which coincidentally is when we ran trickster.exe. 181 181
And after it's triggered, 182 182
it's going to happen every three minutes for one day. 183 183
So every three minutes for the next 24 hours, 184 184
it's going to keep doing this program. 185 185
And what is it going to do? 186 186
Well, it's going to start this program, this u.exe program. 187 187
Now we don't know what u.exe does yet, 188 188
but we do know that Trickster wants it 189 189
to run every three minutes. 190 190
So if you had to venture a guess as to what the function of 191 191
this program is, what do you think it would be? 192 192
I think it's probably a beacon. 193 193
It's probably calling out to a command and control server 194 194
and saying, "Hey, I've infected this machine. 195 195
I'm here and I'm ready for orders." 196 196
That's what I think this is doing, 197 197
but we'll look into that as we go through 198 198
and try to prove our thoughts on this. 199 199
Next, we can look at the conditions and you can see that it 200 200
will start all the time. 201 201
It will only stop if the computer ceases to be idle. 202 202
And we can look at our settings here. 203 203
It's going to be a task that's run on demand. 204 204
It's going to run it as soon as possible. 205 205
And we can see the history. 206 206
Has it happened yet? 207 207
Well, not really because the history was disabled here. 208 208
There is no logging. 209 209
But on a good system in an enterprise network, 210 210
you may have this enabled and be able 211 211
to see all the times that it ran, but since we don't, 212 212
we're going to go ahead and look at this system 213 213
and see if we can figure it out. 214 214
And so we can see that the next time 215 215
this is going to run is in just about a minute. 216 216
Now, if we sit here for a minute, 217 217
we're not going to see anything because 218 218
this program is run in the background. 219 219
This program is run as a beacon and that's just going to run 220 220
where we can't even see it. 221 221
And so we're going to have to look at something like a process 222 222
explorer or be able to see the network traffic 223 223
and see that call out occur. 224 224
We're going to use a program to see that call out happen 225 225
and prove if this is or is not a beacon. 226 226
Now, if you remember, we had a file, that u.exe, 227 227
that was being run on our machine. 228 228
It is located under the C drive, 229 229
and then under the user drive, 230 230
under our user account of IE user, 231 231
under app data, under roaming, and then under winamp. 232 232
And you'll see, there it is. 233 233
Now, there are three other things here, 234 234
one folder and two files. 235 235
Let's see if there's anything inside this module's folder. 236 236
Well, there isn't yet. 237 237
And the reason why is the stage one malware, 238 238
this us.exe file, has been making its call out, 239 239
but we stopped it before it ever had 240 240
a chance to download any modules or malware, and really, 241 241
the reason why is because the IP addresses 242 242
it's calling to are benign. 243 243
They are not malicious. 244 244
But if this was a real piece of malware that was dangerous, 245 245
it could be calling out and downloading that stuff into 246 246
these modules and running that stage two malware to make it 247 247
part of a botnet, or steal your files, 248 248
or conduct ransomware, 249 249
or whatever its decided method would be. 250 250
Next, it has two text files here, client ID and group tag. 251 251
And I'm going to open up client ID first and we're going to go 252 252
ahead and open this with Notepad. 253 253
Now, the client ID here, this is my host name, MSEdgeWin10. 254 254
What is all of this behind it? 255 255
Well, this becomes a unique identifier or a serial number, 256 256
and that's what this malware is doing. 257 257
It is going to be connecting to all of these machines and try 258 258
to do something with that information. 259 259
If it's putting 'em in a botnet, 260 260
it needs to know what machines are what. 261 261
If it's going to do ransomware, 262 262
it needs to know who you are so that when you pay them, 263 263
they can release your machine or not, 264 264
depending on how the attacker's going to do their job. 265 265
But again, they need a way to identify you, 266 266
and that's what this client ID is. 267 267
It's just simply a serial number. 268 268
Next, we have this group tag. 269 269
And if we open up the group tag in Notepad, 270 270
we can see it just says TT0002, 271 271
which is just an alpha numeric code for this group 272 272
that your machine is being put into. 273 273
And again, if you're going to be part of a botnet, 274 274
maybe I want to be able to sell off 100 machines, 275 275
or 1,000 machines, or 10,000 machines at a time 276 276
to conduct a DDOS attack. 277 277
Well, I need a way to group those together, 278 278
and this group tag is simply that. 279 279
So, those are those two files and the module 280 280
and that's what it did onto our hard drive, 281 281
but it really hasn't done anything malicious yet because 282 282
this is just the stage one dropper. 283 283
Now you can see how we might be going down 284 284
all the way through and digging really, 285 285
really deep into this malware to figure out exactly what 286 286
it's doing and how it's doing it. 287 287
And you can keep following these 288 288
breadcrumbs all the way down, but at this point, 289 289
we already have three different indicators of compromise. 290 290
The first would be the file hash for trickster.exe, 291 291
the second would be the fact that it goes 292 292
and creates this process, this executable, 293 293
this u.exe file and places it 294 294
in the roaming winamp directory. 295 295
Another one is the fact that it creates this client ID and 296 296
this group tag and this modules folder. 297 297
So we already have three right there. 298 298
But if we want to dig deeper, 299 299
we can actually start digging into this 300 300
further, and further, and further. 301 301
So now that we've done the dynamic analysis 302 302
and figured out that this is a stage one dropper, 303 303
that it's beaconing out every three minutes, 304 304
and that it's calling out to this particular IP address 305 305
and it's creating this client ID and this group tag, 306 306
let's go and look at it statically and dig just a little bit 307 307
deeper to figure out what else 308 308
we can determine inside of Trickster. 309 309
So now that we've kind of exhausted 310 310
what we can do dynamically, 311 311
we're going to dig back into static analysis just a little bit. 312 312
So the way we're going to do this is by opening up the 313 313
u.exe file in a program called IDA. 314 314
Now, IDA is a decompiler and we can find it here inside of 315 315
Flair and then into Disassemblers. 316 316
Now this decompiler we're going to open up is IDA Free, 317 317
which is the freeware version of IDA Pro. 318 318
It's going to allow us to do quite a bit 319 319
and we're only going to use a very little bit about it. 320 320
So what we're going to do is we're going to disassemble a new file 321 321
and all we have to do here is drag it 322 322
on here to disassemble it. 323 323
So I'm going to bring back up that file, u.exe, 324 324
and drag it and drop it onto IDA. 325 325
So, we're going to load it up and we have to choose, 326 326
is it an executable from DOSS, a portable executable, 327 327
or a binary file? 328 328
In our case, 329 329
I believe it to be a portable executable because it's 330 330
running inside of Windows and not inside of DOSS 331 331
as we saw from that comment 332 332
we pulled out using the Floss tool. 333 333
So we're just going to go ahead and hit okay. 334 334
And up it's going to pop. 335 335
Now, if you notice here in IDA view A on the left side, 336 336
it's going through and giving us the assembly code for this 337 337
program the best it can based on 338 338
decompiling it and making its best guesses. 339 339
Now, what we really care about here in IDA though 340 340
is what imports and exports is this thing using. 341 341
So I'm going to go ahead and hit exports 342 342
and we really don't see anything. 343 343
If I go ahead and hit imports, 344 344
you can see all of the different processes and functions 345 345
that are called from the kernel 346 346
and from the APIs in Windows. 347 347
And so here we have our imports and we can see the different 348 348
types of functions that this program calls. 349 349
For instance, 350 350
it opens and closes registry keys and queries them. 351 351
And we notice that in process monitor 352 352
that it did a lot of things with the registry. 353 353
We can see the fact that it can create files 354 354
or get a current directory. 355 355
It can get command line arguments and run commands. 356 356
It can load strings, it can register classes, 357 357
it can do all sorts of different things. 358 358
And as we scroll through this, 359 359
we can learn a little bit about the program and what it's 360 360
capable of doing just by looking through the different 361 361
processes that it may be able to run. 362 362
Now, that gives us some information, 363 363
but it doesn't give us a whole lot to go on. 364 364
So unless you're able to actually read these assembly 365 365
language programs and be able to go through it step-by-step, 366 366
this is not really going to help us for an 367 367
introductory level malware analysis. 368 368
Now, if you want to go through it and 369 369
reverse engineer this entire thing, well, 370 370
you're going to have to go through a different class 371 371
because that is way, 372 372
way more in depth than this class is going to be looking at. 373 373
Now let's go ahead and close out of IDA 374 374
and we'll go ahead and just say okay. 375 375
And what we're going to look at here is we are going to take 376 376
this program, u.exe, and run it through a debugger. 377 377
Now a debugger allows us to run a program step by step, 378 378
one instruction at a time as it goes through. 379 379
So we're just going to just go ahead and say yes here. 380 380
And yes. 381 381
Now what I want to do is I want to 382 382
open up our file inside of AliDebug. 383 383
And to do that, I'm just going to go in here to the C drive, 384 384
going to go down to users, ieuser, app data, roaming, 385 385
and then down to the bottom for winapp and there is u.exe. 386 386
Once we open that up here, you can see, just like before, 387 387
we have all of our assembly language here as best as this 388 388
can decompile and run it through step by step. 389 389
Now, a lot of malware is going to protect itself 390 390
from being run step by step. 391 391
Let's find out if Trickster and u.exe 392 392
is one of those pieces of malware. 393 393
So what we are going to do is we are 394 394
going to go ahead and play it. 395 395
And if you see the little play icon right here, 396 396
it's going to go through, and just say yes, 397 397
it goes through and attempts to play 398 398
this program step by step. 399 399
Now, when we do it, 400 400
it runs very quickly and then it just terminates. 401 401
Nothing really happened for us, right? 402 402
Well, that means that this piece of malware most likely is 403 403
detecting the fact that it's in 404 404
a debugger and going step by step. 405 405
And so we're going to have to use a little bit more complex 406 406
method to be able to pull out that code 407 407
and then analyze it in our static analysis. 408 408
We saw that it was encrypted when we tried to run Floss 409 409
earlier on and now when we try to run it through a debugger, 410 410
we are actually getting it where it stops immediately. 411 411
So it's detecting the fact that it's 412 412
being stepped through the program. 413 413
So instead what we're going to have to do 414 414
is we're going to have to run the process, 415 415
capture it in memory while it's being unpacked, 416 416
and then be able to analyze it. 417 417
Now, to do that, we have to start with a clean VM again. 418 418
And so what I'm going to do here is I'm going to pause this and 419 419
bring ourself back up to a clean VM 420 420
with our antivirus turned off, 421 421
our firewall turned off, 422 422
and Trickster expanded onto the desktop. 423 423
So, we are back and we now have our flare VM 424 424
and we should have our antivirus off, 425 425
we have our firewall off, 426 426
and we've unzipped the Trickster file. 427 427
But before we move any further, 428 428
we need to download a piece of software called Process Dump. 429 429
So we're going to go ahead and open up our Edge browser, 430 430
and from our Edge browser, 431 431
we want to go to split-code.com/processdump.html. 432 432
That's split-code.com/processdump.html. 433 433
And when we go there, 434 434
you are going to be able to download the Process Dump file, 435 435
which currently is version 2.1 for Windows 32 or 64-bit. 436 436
And since we're operating on a 64-bit operating system, 437 437
that will work fine for us. 438 438
We're going to go ahead and hit open 439 439
and it's going to open it here on our desktop 440 440
and we're going to take PD64 and drop it onto our desktop 441 441
so it's ready for us to use. 442 442
And we can go ahead and close our Edge browser. 443 443
So now that we have PD64 on the desktop, 444 444
we want to go ahead and open up a command prompt, 445 445
but I want to right-click on it this time 446 446
and run it as administrator. 447 447
So go ahead and say yes. 448 448
So now that we have our command prompt 449 449
open as an administrator, 450 450
we want to get into the directory that is our desktop, 451 451
which is going to be under C:/users/ieuser/desktop. 452 452
And if we hit DIR, 453 453
you can see Trickster and PD64 454 454
are sitting there on the desktop. 455 455
So now, I want to go ahead and run PD64 and create a hash 456 456
database of all of the processes that are currently running 457 457
before I put any malware in there. 458 458
So I'm going to do that by doing PD64.exe-DB for database, 459 459
space gen, or G-E-N for generate. 460 460
And then go ahead and hit enter. 461 461
Now this is going to go through and find all of the processes 462 462
that are sitting there on this system and it's going to capture 463 463
them and create a good hash value 464 464
for all of those processes. 465 465
Now this is going to take somewhere around five to 10 minutes, 466 466
depending on how fast your system is. 467 467
And so I'm going to go ahead and pause the video here and come 468 468
back once that hash database has been created. 469 469
Then, we're going to be able to go and run Trickster 470 470
and capture that malicious process 471 471
and dump it and then look at it inside of IDA. 472 472
Now, once the program is done, 473 473
you're going to get this finished, 474 474
the clean hash database has now been created. 475 475
And you'll notice here on your desktop you have the clean 476 476
hashes file that is going to serve as that database. 477 477
The next step to capture Trickster 478 478
is to type in the command PD64.exe-P 479 479
and then the name of the file that's going to be running, 480 480
which is trickster.exe. 481 481
But don't hit enter just yet. 482 482
We have to go and create Trickster first 483 483
because if I try to hit enter right now, 484 484
it's not going to find anything because 485 485
Trickster doesn't exist. 486 486
So I'm going to get it ready to go, 487 487
right-click on Trickster, tell it to run as admin. 488 488
Then as soon as I hit yes, 489 489
I'm going to click on the command prompt and hit enter 490 490
to capture that process. 491 491
So yes, click, enter. 492 492
And you'll see here that it is dumping that exe file to the 493 493
file tricksterexepidedtricksterexe, 494 494
this big, long file name right here. 495 495
And as you can see, that is now on the desktop, 496 496
which is that piece of malware 497 497
unpacked and straight from memory. 498 498
So, the next step is to open this up in IDA again. 499 499
So we're going to go ahead and go to our Windows icon, 500 500
type in I-D-A and IDA should show up. 501 501
We'll open that up, 502 502
tell it we don't need the information displayed, 503 503
agree to the terms and conditions, and tell it new. 504 504
And we'll go ahead and hit cancel. 505 505
Then we need to go ahead and get the file from the desktop, 506 506
that trickster.exe file, 507 507
that new one that we just dumped, 508 508
and drop it into IDA. 509 509
Go ahead and hit okay and okay. 510 510
And now we have that file we just captured from memory, 511 511
that we dumped from that process, 512 512
and we can start looking at it 513 513
to see if there's anything of interest to us. 514 514
This should be a little bit more fruitful 515 515
than the first time we looked at it in IDA. 516 516
So let's go ahead and look at our imports one more time. 517 517
Now, we have a couple of new ones here 518 518
that we didn't have last time, 519 519
namely the sleep and the get tick count. 520 520
Now, what do these do? 521 521
Well, get tick count is counting the processes. 522 522
It's basically a clock. 523 523
And then there's this sleep function. 524 524
Now what is that doing? 525 525
Well, let's go ahead and double-click on sleep. 526 526
We see that we have this sleep is going to happen for some 527 527
amount of milliseconds. 528 528
And if I go ahead and look at this, 529 529
I can see here it says push1388H, 530 530
which is the amount of milliseconds that it's going to wait 531 531
as it's sleeping. 532 532
Now what does that equate to? 533 533
Well, that equates to five seconds. 534 534
Now, why might it be waiting five seconds? 535 535
Well, if we start walking through this program, 536 536
you're going to see that the reason it is sleeping for five 537 537
seconds and using that tick count 538 538
to figure out what time it is, 539 539
is so that it has time to launch the program and then create 540 540
the file and folder and copy in u.exe 541 541
to the hard drive and then run u.exe. 542 542
That's what these calls are there for. 543 543
So it starts, it waits, it creates the folder, 544 544
it waits, it runs the program, it waits. 545 545
That's the idea here. 546 546
So those are two new functions. 547 547
Now, why does it do that? 548 548
The reason why is because it is doing this as a way to 549 549
detect if things are ready for the next step. 550 550
And so you can see, if you can read assembly code, 551 551
as you go through here, 552 552
all of the things that this 553 553
particular piece of malware does. 554 554
Now, again, 555 555
we're not going to go through and dig into 556 556
every single line of this code. 557 557
It's just too much and too in depth for this course. 558 558
This is not a class on assembly language 559 559
or malware reverse engineering. 560 560
But I just wanted to give you an idea of the type of 561 561
information that you can find by process dumping this and 562 562
loading it up into IDA doing a very cursory search. 563 563
So again, 564 564
this class is not designed to have you dig through this 565 565
static analysis and learn every single piece about this 566 566
program and how to reverse engineer it. 567 567
Instead, 568 568
I just wanted to give you a couple of quick tidbits so that 569 569
you can kind of wet your appetite if you want to go down 570 570
this malware reverse engineering route and really start 571 571
digging into assembly code and how these things work. 572 572
This is just to give you a little bit of exposure to it, 573 573
not to make you an expert. 574 574
Wow, I know that was a long video and that was a ton of 575 575
information that was way in depth. 576 576
Now the good news is for the exam, 577 577
you do not need to know how to do everything 578 578
I just walked through in this video. 579 579
Instead, 580 580
I was doing it just to give you an introduction so you could 581 581
see how this stuff works and start putting some of these 582 582
pieces together early in the course. 583 583
Now, as we go through the rest of this course, 584 584
we're going to dive deeper into a lot of these different 585 585
concepts as we talk about indicators 586 586
of compromise on the network, 587 587
as we talk about indicators of compromise 588 588
from the file system, 589 589
as we talk about persistence like we saw with 590 590
the scheduled tasks, and things like that. 591 591
So this is just to give you a good overview 592 592
and then we're going to dig deeper into each of those areas. 593 593
And you'll really be answering multiple choice questions on 594 594
the exam about these concepts as opposed to having to 595 595
actually do the physical work of analyzing every single 596 596
piece of this malware like I was doing inside this video.